STIGhub
STIGs
RMF Controls
Compare
← AC-2 (1) — Account Management
CCI-000015
Definition
Support the management of system accounts using organization-defined automated mechanisms.
Parent Control
AC-2 (1)
Account Management
Access Control
Linked STIG Checks (200)
V-204636
CAT II
AAA Services must be configured to provide automated account management functions.
AAA Services Security Requirements Guide
V-204682
CAT II
AAA Services must be configured to notify the system administrators (SAs) and information system security officer (ISSO) when accounts are created.
AAA Services Security Requirements Guide
V-204683
CAT II
AAA Services must be configured to notify the system administrators (SAs) and information system security officer (ISSO) when accounts are modified.
AAA Services Security Requirements Guide
V-204684
CAT II
AAA Services must be configured to notify the system administrators (SAs) and information system security officer (ISSO) for account disabling actions.
AAA Services Security Requirements Guide
V-204685
CAT II
AAA Services must be configured to notify the system administrators (SAs) and information system security officer (ISSO) for account removal actions.
AAA Services Security Requirements Guide
V-204687
CAT II
AAA Services must be configured to notify system administrators (SAs) and information system security officer (ISSO) of account enabling actions.
AAA Services Security Requirements Guide
V-274027
CAT II
Amazon Linux 2023 must have the firewalld package installed.
Amazon Linux 2023 Security Technical Implementation Guide
V-274028
CAT II
Amazon Linux 2023 must have the firewalld service active.
Amazon Linux 2023 Security Technical Implementation Guide
V-274081
CAT II
Amazon Linux 2023 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
Amazon Linux 2023 Security Technical Implementation Guide
V-274082
CAT II
Amazon Linux 2023 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/ directory.
Amazon Linux 2023 Security Technical Implementation Guide
V-274083
CAT II
Amazon Linux 2023 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
Amazon Linux 2023 Security Technical Implementation Guide
V-274084
CAT II
Amazon Linux 2023 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
Amazon Linux 2023 Security Technical Implementation Guide
V-274085
CAT II
Amazon Linux 2023 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.
Amazon Linux 2023 Security Technical Implementation Guide
V-274104
CAT II
Amazon Linux 2023 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
Amazon Linux 2023 Security Technical Implementation Guide
V-274113
CAT II
Amazon Linux 2023 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
Amazon Linux 2023 Security Technical Implementation Guide
V-274114
CAT II
Amazon Linux 2023 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
Amazon Linux 2023 Security Technical Implementation Guide
V-268167
CAT II
NixOS must generate audit records for all account creations, modifications, disabling, and termination events.
Anduril NixOS Security Technical Implementation Guide
V-222407
CAT II
The application must provide automated mechanisms for supporting account management functions.
Application Security and Development Security Technical Implementation Guide
V-222417
CAT III
The application must notify system administrators (SAs) and information system security officers (ISSOs) when accounts are created.
Application Security and Development Security Technical Implementation Guide
V-222418
CAT III
The application must notify system administrators (SAs) and information system security officers (ISSOs) when accounts are modified.
Application Security and Development Security Technical Implementation Guide
V-222419
CAT III
The application must notify system administrators (SAs) and information system security officers (ISSOs) of account disabling actions.
Application Security and Development Security Technical Implementation Guide
V-222420
CAT III
The application must notify system administrators (SAs) and information system security officers (ISSOs) of account removal actions.
Application Security and Development Security Technical Implementation Guide
V-222422
CAT III
The application must notify system administrators (SAs) and information system security officers (ISSOs) of account enabling actions.
Application Security and Development Security Technical Implementation Guide
V-237321
CAT I
The ArcGIS Server must use Windows authentication for supporting account management functions.
ArcGIS for Server 10.3 Security Technical Implementation Guide
V-272627
CAT III
CylanceON-PREM must be configured to use a third-party identity provider.
Arctic Wolf CylanceON-PREM Security Technical Implementation Guide
V-256842
CAT II
Compliance Guardian must provide automated mechanisms for supporting account management functions.
AvePoint Compliance Guardian Security Technical Implementation Guide
V-253513
CAT II
DocAve must provide automated mechanisms for supporting account management functions.
AvePoint DocAve 6 Security Technical Implementation Guide
V-276012
CAT I
Ax-OS must have no local accounts for the user interface.
Axonius Federal Systems Ax-OS Security Technical Implementation Guide
V-276014
CAT I
Ax-OS must off-load audit records onto a different system or media than the system being audited.
Axonius Federal Systems Ax-OS Security Technical Implementation Guide
V-224379
CAT II
The BlackBerry UEM server must be configured to leverage the MDM platform user accounts and groups for BlackBerry UEM server user identification and CAC authentication.
BlackBerry UEM Security Technical Implementation Guide
V-224380
CAT II
Authentication of MDM platform accounts must be configured so they are implemented via an enterprise directory service.
BlackBerry UEM Security Technical Implementation Guide
V-251583
CAT II
IDMS must support the implementation of an external security manager (ESM) to handle account management and user accesses, etc.
CA IDMS Security Technical Implementation Guide
V-206484
CAT III
For devices and hosts within its scope of coverage, the Central Log Server must be configured to notify the system administrator (SA) and information system security officer (ISSO) when account modification events are received.
Central Log Server Security Requirements Guide
V-206485
CAT III
For devices and hosts within its scope of coverage, the Central Log Server must notify the system administrator (SA) and information system security officer (ISSO) when events indicating account disabling actions are received.
Central Log Server Security Requirements Guide
V-206486
CAT III
For devices and hosts within its scope of coverage, the Central Log Server must notify the System Administrator (SA) and Information System Security Officer (ISSO) when events indicating account removal actions are received.
Central Log Server Security Requirements Guide
V-221921
CAT III
The Central Log Server must notify system administrators and ISSO when accounts are created.
Central Log Server Security Requirements Guide
V-259872
CAT I
The Mission Owner must configure the customer service portal credentials for least privilege.
Cloud Computing Mission Owner Operating System Security Requirements Guide
V-269129
CAT II
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269130
CAT II
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269131
CAT II
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269132
CAT II
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269133
CAT II
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269134
CAT II
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269135
CAT II
AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect the files within /etc/sudoers.d/
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-272485
CAT II
AlmaLinux OS 9 must have the postfix package installed.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-233019
CAT II
The container platform must use a centralized user management solution to support account management functions.
Container Platform Security Requirements Guide
V-233143
CAT II
The container platform must notify system administrators (SAs) and the information system security officer (ISSO) when accounts are created.
Container Platform Security Requirements Guide
V-233144
CAT II
The container platform must notify system administrators (SAs) and the information system security officer (ISSO) when accounts are modified.
Container Platform Security Requirements Guide
V-233145
CAT II
The container platform must notify system administrators and ISSO for account disabling actions.
Container Platform Security Requirements Guide
V-233146
CAT II
The container platform must notify system administrators and ISSO for account removal actions.
Container Platform Security Requirements Guide
V-233158
CAT II
The container platform must notify the system administrator (SA) and information system security officer (ISSO) of account enabling actions.
Container Platform Security Requirements Guide
V-233515
CAT I
PostgreSQL must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.
Crunchy Data PostgreSQL Security Technical Implementation Guide
V-261858
CAT I
PostgreSQL must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.
Crunchy Data Postgres 16 Security Technical Implementation Guide
V-255529
CAT I
The DBN-6300 must provide automated support for account management functions.
DBN-6300 NDM Security Technical Implementation Guide
V-206520
CAT I
The DBMS must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.
Database Security Requirements Guide
V-235780
CAT II
LDAP integration in Docker Enterprise must be configured.
Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide
V-270910
CAT II
Dragos Platform must use an Identity Provider (IDP) for authentication and authorization processes.
Dragos Platform 2.x Security Technical Implementation Guide
V-224131
CAT I
The EDB Postgres Advanced Server must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.
EDB Postgres Advanced Server v11 on Windows Security Technical Implementation Guide
V-213562
CAT I
The EDB Postgres Advanced Server must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.
EDB Postgres Advanced Server v9.6 Security Technical Implementation Guide
V-259211
CAT I
The EDB Postgres Advanced Server must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.
EnterpriseDB Postgres Advanced Server (EPAS) Security Technical Implementation Guide
V-228978
CAT II
The BIG-IP appliance must provide automated support for account management functions.
F5 BIG-IP Device Management Security Technical Implementation Guide
V-203591
CAT II
The operating system must provide automated mechanisms for supporting account management functions.
General Purpose Operating System Security Requirements Guide
V-203678
CAT II
The operating system must notify system administrators and ISSOs when accounts are created.
General Purpose Operating System Security Requirements Guide
V-203679
CAT II
The operating system must notify system administrators and ISSOs when accounts are modified.
General Purpose Operating System Security Requirements Guide
V-203680
CAT II
The operating system must notify system administrators and ISSOs when accounts are disabled.
General Purpose Operating System Security Requirements Guide
V-203681
CAT II
The operating system must notify system administrators and ISSOs when accounts are removed.
General Purpose Operating System Security Requirements Guide
V-203691
CAT II
The operating system must notify system administrators (SAs) and information system security officers (ISSOs) of account enabling actions.
General Purpose Operating System Security Requirements Guide
V-237825
CAT I
The storage system must only be operated in conjunction with an LDAP server in a trusted environment if an Active Directory server is not available.
HPE 3PAR StoreServ 3.2.x Security Technical Implementation Guide
V-237827
CAT I
The storage system must only be operated in conjunction with an Active Directory server in a trusted environment if an LDAP server is not available.
HPE 3PAR StoreServ 3.2.x Security Technical Implementation Guide
V-255278
CAT II
The HPE 3PAR OS must be configured for centralized account management functions via LDAP.
HPE 3PAR StoreServ 3.3.x Security Technical Implementation Guide
V-255288
CAT II
The HPE 3PAR OS must provide automated mechanisms for supporting account management functions via AD.
HPE 3PAR StoreServ 3.3.x Security Technical Implementation Guide
V-215169
CAT II
AIX /etc/security/mkuser.sys.custom file must not exist unless it is needed for customizing a new user account.
IBM AIX 7.x Security Technical Implementation Guide
V-215181
CAT II
The shipped /etc/security/mkuser.sys file on AIX must not be customized directly.
IBM AIX 7.x Security Technical Implementation Guide
V-215182
CAT II
The regular users default primary group must be staff (or equivalent) on AIX.
IBM AIX 7.x Security Technical Implementation Guide
V-215246
CAT II
AIX must provide audit record generation functionality for DoD-defined auditable events.
IBM AIX 7.x Security Technical Implementation Guide
V-213671
CAT II
DB2 must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.
IBM DB2 V10.5 LUW Security Technical Implementation Guide
V-255727
CAT II
Access to the MQ Appliance network element must use two or more authentication servers for the purpose of granting administrative access.
IBM MQ Appliance v9.0 NDM Security Technical Implementation Guide
V-82169
CAT II
The MaaS360 MDM server must be configured to leverage the MDM platform user accounts and groups for MaaS360 MDM server user identification and authentication.
IBM MaaS360 with Watson v10.x MDM Security Technical Implementation Guide
V-82171
CAT II
Authentication of MaaS360 MDM platform accounts must be configured so they are implemented via an enterprise directory service.
IBM MaaS360 with Watson v10.x MDM Security Technical Implementation Guide
V-223422
CAT I
CA-ACF2 OPTS GSO record must be set to ABORT mode.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223540
CAT II
The IBM z/OS system administrator (SA) must develop a process notify appropriate personnel when accounts are removed.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223541
CAT II
The IBM z/OS system administrator (SA) must develop a process notify appropriate personnel when accounts are modified.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223542
CAT II
The IBM z/OS system administrator (SA) must develop a process notify appropriate personnel when accounts are deleted.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223543
CAT II
The IBM z/OS system administrator (SA) must develop a process notify appropriate personnel when accounts are created.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223579
CAT II
IBM z/OS system administrator must develop a procedure to notify system administrators (SAs) and information system security officers (ISSOs) of account enabling actions.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223760
CAT I
IBM RACF must be installed and active on the system.
IBM z/OS RACF Security Technical Implementation Guide
V-223762
CAT II
The IBM z/OS system administrator (SA) must develop a process to notify appropriate personnel when accounts are created.
IBM z/OS RACF Security Technical Implementation Guide
V-223763
CAT II
The IBM z/OS system administrator (SA) must develop a process to notify appropriate personnel when accounts are modified.
IBM z/OS RACF Security Technical Implementation Guide
V-223764
CAT II
The IBM z/OS system administrator (SA) must develop a process to notify appropriate personnel when accounts are deleted.
IBM z/OS RACF Security Technical Implementation Guide
V-223765
CAT II
The IBM z/OS system administrator (SA) must develop a process to notify appropriate personnel when accounts are removed.
IBM z/OS RACF Security Technical Implementation Guide
V-223766
CAT II
The IBM z/OS system administrator (SA) must develop a process to notify information system security officers (ISSOs) of account enabling actions.
IBM z/OS RACF Security Technical Implementation Guide
V-223876
CAT I
CA-TSS MODE Control Option must be set to FAIL.
IBM z/OS TSS Security Technical Implementation Guide
V-224013
CAT II
The IBM z/OS system administrator (SA) must develop a process to notify appropriate personnel when accounts are created.
IBM z/OS TSS Security Technical Implementation Guide
V-224014
CAT II
The IBM z/OS system administrator (SA) must develop a process to notify appropriate personnel when accounts are modified.
IBM z/OS TSS Security Technical Implementation Guide
V-224015
CAT II
The IBM z/OS system administrator (SA) must develop a process to notify appropriate personnel when accounts are deleted.
IBM z/OS TSS Security Technical Implementation Guide
V-224016
CAT II
The IBM z/OS system administrator (SA) must develop a process to notify appropriate personnel when accounts are removed.
IBM z/OS TSS Security Technical Implementation Guide
V-224037
CAT II
IBM z/OS system administrator (SA) must develop a procedure to notify SAs and information system security officers (ISSOs) of account enabling actions.
IBM z/OS TSS Security Technical Implementation Guide
V-237897
CAT I
CA VM:Secure product Rules Facility must be installed and operating.
IBM zVM Using CA VM:Secure Security Technical Implementation Guide
V-237898
CAT I
The IBM z/VM TCP/IP DTCPARMS files must be properly configured to connect to an external security manager.
IBM zVM Using CA VM:Secure Security Technical Implementation Guide
V-241796
CAT II
The Jamf Pro EMM server must be configured to leverage the MDM platform user accounts and groups for Jamf Pro EMM server user identification and CAC authentication.
Jamf Pro v10.x EMM Security Technical Implementation Guide
V-241797
CAT II
Authentication of Jamf Pro EMM server accounts must be configured so they are implemented either via an Authentication Gateway Service (AGS) which connects to the site DoD Identity Access Management (IdAM) environment that utilizes CAC authentication or via strong password controls for the administrator local accounts.
Jamf Pro v10.x EMM Security Technical Implementation Guide
V-229021
CAT III
The Juniper SRX Services Gateway must allow only the information system security manager (ISSM) (or administrators/roles appointed by the ISSM) to select which auditable events are to be generated and forwarded to the syslog and/or local logs.
Juniper SRX Services Gateway NDM Security Technical Implementation Guide
V-229022
CAT III
For local logging, the Juniper SRX Services Gateway must generate a message to the system management console when a log processing failure occurs.
Juniper SRX Services Gateway NDM Security Technical Implementation Guide
V-229023
CAT II
In the event that communications with the events server is lost, the Juniper SRX Services Gateway must continue to queue log records locally.
Juniper SRX Services Gateway NDM Security Technical Implementation Guide
V-229025
CAT I
The Juniper SRX Services Gateway must be configured to use a centralized authentication server to authenticate privileged users for remote and nonlocal access for device management.
Juniper SRX Services Gateway NDM Security Technical Implementation Guide
V-242381
CAT I
The Kubernetes Controller Manager must create unique service accounts for each work payload.
Kubernetes Security Technical Implementation Guide
V-213858
CAT II
SQL Server authentication and identity management must be integrated with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.
MS SQL Server 2014 Instance Security Technical Implementation Guide
V-213900
CAT I
SQL Server databases must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.
MS SQL Server 2016 Database Security Technical Implementation Guide
V-213930
CAT I
SQL Server must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.
MS SQL Server 2016 Instance Security Technical Implementation Guide
V-213931
CAT II
SQL Server must be configured to utilize the most-secure authentication method available.
MS SQL Server 2016 Instance Security Technical Implementation Guide
V-205444
CAT II
The Mainframe Product must use an external security manager for all account management functions.
Mainframe Product Security Requirements Guide
V-205531
CAT II
The Mainframe Product must notify system programmers and security administrators when accounts are created.
Mainframe Product Security Requirements Guide
V-205532
CAT II
The Mainframe Product must notify system programmers and security administrators when accounts are modified.
Mainframe Product Security Requirements Guide
V-205533
CAT II
The Mainframe Product must notify system programmers and security administrators for account disabling actions.
Mainframe Product Security Requirements Guide
V-205534
CAT II
The Mainframe Product must notify system programmers and security administrators for account removal actions.
Mainframe Product Security Requirements Guide
V-205542
CAT II
The Mainframe Product must notify system programmers and security administrators of account enabling actions.
Mainframe Product Security Requirements Guide
V-253667
CAT I
MariaDB must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.
MariaDB Enterprise 10.x Security Technical Implementation Guide
V-220340
CAT II
MarkLogic Server must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.
MarkLogic Server v9 Security Technical Implementation Guide
V-255301
CAT I
Azure SQL Databases must integrate with Azure Active Directory for providing account management and automation for all users, groups, roles, and any other principals.
Microsoft Azure SQL Database Security Technical Implementation Guide
V-255302
CAT I
Azure SQL Database must enforce approved authorizations for logical access to server information and system resources in accordance with applicable access control policies.
Microsoft Azure SQL Database Security Technical Implementation Guide
V-276225
CAT I
Azure SQL Managed Instances must integrate with Microsoft Entra ID for providing account management and automation for all users, groups, roles, and any other principals.
Microsoft Azure SQL Managed Instance Security Technical Implementation Guide
V-270255
CAT II
Microsoft Entra ID must notify system administrators (SAs) and the information system security officer (ISSO) when privileges are being requested.
Microsoft Entra ID Security Technical Implementation Guide
V-271118
CAT I
SQL Server must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.
Microsoft SQL Server 2022 Database Security Technical Implementation Guide
V-271264
CAT I
SQL Server must be configured to use the most-secure authentication method available.
Microsoft SQL Server 2022 Instance Security Technical Implementation Guide
V-271265
CAT I
SQL Server must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.
Microsoft SQL Server 2022 Instance Security Technical Implementation Guide
V-260909
CAT II
MKE must be configured to integrate with an Enterprise Identity Provider.
Mirantis Kubernetes Engine Security Technical Implementation Guide
V-91821
CAT II
Authentication of MDM platform accounts must be configured so they are implemented via an enterprise directory service.
MobileIron Core v10.x MDM Security Technical Implementation Guide
V-221158
CAT I
MongoDB must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.
MongoDB Enterprise Advanced 3.x Security Technical Implementation Guide
V-252149
CAT I
MongoDB must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.
MongoDB Enterprise Advanced 4.x Security Technical Implementation Guide
V-265905
CAT I
MongoDB must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.
MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide
V-279332
CAT I
MongoDB must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.
MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide
V-279541
CAT II
Nutanix OS must audit all account change actions.
Nutanix Acropolis GPOS Security Technical Implementation Guide
V-219749
CAT II
The system must employ automated mechanisms for supporting Oracle user account management.
Oracle Database 11.2g Security Technical Implementation Guide
V-220265
CAT I
The system must employ automated mechanisms for supporting Oracle user account management.
Oracle Database 12c Security Technical Implementation Guide
V-270499
CAT I
Oracle Database must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.
Oracle Database 19c Security Technical Implementation Guide
V-248740
CAT II
OL 8 must generate audit records for all account creation events that affect "/etc/shadow".
Oracle Linux 8 Security Technical Implementation Guide
V-248741
CAT II
OL 8 must generate audit records for all account creation events that affect "/etc/security/opasswd".
Oracle Linux 8 Security Technical Implementation Guide
V-248742
CAT II
OL 8 must generate audit records for all account creation events that affect "/etc/passwd".
Oracle Linux 8 Security Technical Implementation Guide
V-248743
CAT II
OL 8 must generate audit records for all account creation events that affect "/etc/gshadow".
Oracle Linux 8 Security Technical Implementation Guide
V-248744
CAT II
OL 8 must generate audit records for all account creation events that affect "/etc/group".
Oracle Linux 8 Security Technical Implementation Guide
V-248745
CAT II
OL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers".
Oracle Linux 8 Security Technical Implementation Guide
V-248746
CAT II
OL 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers.d/".
Oracle Linux 8 Security Technical Implementation Guide
V-271527
CAT II
OL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
Oracle Linux 9 Security Technical Implementation Guide
V-271528
CAT II
OL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/ directory.
Oracle Linux 9 Security Technical Implementation Guide
V-271529
CAT II
OL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
Oracle Linux 9 Security Technical Implementation Guide
V-271530
CAT II
OL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
Oracle Linux 9 Security Technical Implementation Guide
V-271531
CAT II
OL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.
Oracle Linux 9 Security Technical Implementation Guide
V-271532
CAT II
OL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
Oracle Linux 9 Security Technical Implementation Guide
V-271533
CAT II
OL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
Oracle Linux 9 Security Technical Implementation Guide
V-235095
CAT I
MySQL Database Server 8.0 must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.
Oracle MySQL 8.0 Security Technical Implementation Guide
V-253523
CAT II
Access to Prisma Cloud Compute must be managed based on user need and least privileged using external identity providers for authentication and grouping to role-based assignments when possible.
Palo Alto Networks Prisma Cloud Compute Security Technical Implementation Guide
V-214052
CAT I
PostgreSQL must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.
PostgreSQL 9.x Security Technical Implementation Guide
V-252843
CAT I
Rancher MCM must use a centralized user management solution to support account management functions. For accounts using password authentication, the container platform must use FIPS-validated SHA-2 or later protocol to protect the integrity of the password authentication process.
Rancher Government Solutions Multi-Cluster Manager Security Technical Implementation Guide
V-254554
CAT II
RKE2 must use a centralized user management solution to support account management functions.
Rancher Government Solutions RKE2 Security Technical Implementation Guide
V-281154
CAT II
RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers".
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281155
CAT II
RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect the "/etc/sudoers.d/" directory.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281156
CAT II
RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group".
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281157
CAT II
RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow".
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281158
CAT II
RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/opasswd".
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281159
CAT II
RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd".
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281160
CAT II
RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/shadow".
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-258217
CAT II
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-258218
CAT II
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/ directory.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-258219
CAT II
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-258220
CAT II
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-258221
CAT II
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-258222
CAT II
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-258223
CAT II
RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-272488
CAT II
RHEL 9 must have the Postfix package installed.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-257507
CAT II
OpenShift must use a centralized user management solution to support account management functions.
Red Hat OpenShift Container Platform 4.12 Security Technical Implementation Guide
V-257508
CAT II
The kubeadmin account must be disabled.
Red Hat OpenShift Container Platform 4.12 Security Technical Implementation Guide
V-257507
CAT II
OpenShift must use a centralized user management solution to support account management functions.
Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide
V-257508
CAT II
The kubeadmin account must be disabled.
Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide
V-257511
CAT II
OpenShift must generate audit rules to capture account related actions.
Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide
V-251184
CAT I
Redis Enterprise DBMS must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.
Redis Enterprise 6.x Security Technical Implementation Guide
V-275713
CAT II
Ubuntu OS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
Riverbed NetIM OS Security Technical Implementation Guide
V-275714
CAT II
Ubuntu OS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
Riverbed NetIM OS Security Technical Implementation Guide
V-275715
CAT II
Ubuntu OS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.
Riverbed NetIM OS Security Technical Implementation Guide
V-275716
CAT II
Ubuntu OS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
Riverbed NetIM OS Security Technical Implementation Guide
V-275717
CAT II
Ubuntu OS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
Riverbed NetIM OS Security Technical Implementation Guide
V-254088
CAT II
Innoslate must provide automated mechanisms for supporting account management functions.
SPEC Innovations Innoslate 4.x Security Technical Implementation Guide
V-217205
CAT II
The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
SUSE Linux Enterprise Server 12 Security Technical Implementation Guide
V-217206
CAT II
The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
SUSE Linux Enterprise Server 12 Security Technical Implementation Guide
V-217207
CAT II
The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
SUSE Linux Enterprise Server 12 Security Technical Implementation Guide
V-217208
CAT II
The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.
SUSE Linux Enterprise Server 12 Security Technical Implementation Guide
V-225649
CAT I
The Samsung SDS EMM server must be configured to use one-time password in addition to username and password for administrator logon to the server.
Samsung SDS EMM Security Technical Implementation Guide
V-245525
CAT I
The Samsung SDS EMM must be configured to leverage the MDM platform administrator accounts and groups for Samsung SDS EMM user identification and CAC authentication.
Samsung SDS EMM Security Technical Implementation Guide
V-245526
CAT I
Authentication of MDM platform accounts must be configured so they are implemented via an enterprise directory service.
Samsung SDS EMM Security Technical Implementation Guide
V-221939
CAT III
Splunk Enterprise must notify the system administrator (SA) and information system security officer (ISSO) when account events are received (creation, deletion, modification, disabling).
Splunk Enterprise 7.x for Windows Security Technical Implementation Guide
V-221940
CAT III
Splunk Enterprise must notify analysts of applicable events for Tier 2 CSSP and JRSS only.
Splunk Enterprise 7.x for Windows Security Technical Implementation Guide
V-251658
CAT III
Splunk Enterprise must notify the system administrator (SA) and information system security officer (ISSO) when account events are received (creation, deletion, modification, or disabling).
Splunk Enterprise 8.x for Linux Security Technical Implementation Guide
V-240988
CAT II
The Tanium Server must be configured with a connector to sync to Microsoft Active Directory for account management functions, must isolate security functions from non-security functions, and must terminate shared/group account credentials when members leave the group.
Tanium 7.0 Security Technical Implementation Guide
V-240989
CAT II
The Tanium Server must be configured to only use Microsoft Active Directory for account management functions.
Tanium 7.0 Security Technical Implementation Guide
V-234049
CAT II
The Tanium Application Server must be configured to only use Microsoft Active Directory for account management functions.
Tanium 7.3 Security Technical Implementation Guide
V-254881
CAT II
The Tanium Application Server must be configured to only use LDAP for account management functions.
Tanium 7.x Application on TanOS Security Technical Implementation Guide
V-254923
CAT II
Tanium must notify system administrator (SA) and the information system security officer (ISSO) when accounts are created.
Tanium 7.x Application on TanOS Security Technical Implementation Guide
V-254924
CAT II
Tanium must notify system administrators (SAs) and the information system security officer (ISSO) when accounts are modified.
Tanium 7.x Application on TanOS Security Technical Implementation Guide
V-254925
CAT II
Tanium must notify system administrators (SAs) and the information system security officer (ISSO) for account disabling actions.
Tanium 7.x Application on TanOS Security Technical Implementation Guide
V-254926
CAT II
Tanium must notify system administrators (SAs) and the information system security officer (ISSO) for account removal actions.
Tanium 7.x Application on TanOS Security Technical Implementation Guide
V-254929
CAT II
Tanium must notify the system administrator (SA) and information system security officer (ISSO) of account enabling actions.
Tanium 7.x Application on TanOS Security Technical Implementation Guide